HE
HE
Our solutionsMicrosoft 365 SecurityGriffin31Admin RightsPatchingWeb SecurityCISO as a Service
AboutCustomer storiesBlogContact
Outsourced security leadership

CISO as a Service

A senior security leader for your organization, without hiring one. We build and run a complete risk management and information security program with you, and you pay only for the hours actually used.

When companies call us

  • A customer’s security questionnaire

    A large customer or partner sent a security questionnaire, and it needs a serious answer.

  • An audit is coming

    An ISO 27001 or SOC 2 audit is on the way, and nobody owns the preparation.

  • Who owns security?

    The board, the insurer or a regulator asks, and today’s answer is “the IT manager, on the side”.

  • After an incident

    There was a cyber incident, or a near miss, and you want to make sure it doesn’t happen again.

What the service covers

  • Risk assessment and security program — Assessments and risk management, and a security program and policy documents built for your organization and recognized standards.
  • Monitoring and incident response — A security monitoring and incident response plan, including management exercises.
  • Disaster recovery and business continuity — A disaster recovery and business continuity plan, including management exercises.
  • Security architecture — Security architecture for your product, network and cloud, and a vulnerability management plan. Penetration tests are run with a third-party partner.
  • Security awareness training — Content built for your organization, delivered in person or live online rather than emailed material, including sessions for senior management.
  • Audit readiness — Preparation for ISO 27001, ISO 27017, ISO 27018 and SOC 2 audits.

Why not a fixed day each week

  • A full-time CISO: expensive and hard to hire, and a mid-size company rarely has a full week of work for one.
  • A fixed day each week: you pay for quiet weeks too, and in an audit or incident week one day isn’t enough.
  • Our CISO as a Service: the scope grows when you need it and shrinks when you don’t, billed by the hours actually used.

Why work with us

  • Not just advice — We also do the work: write the policies, set up the processes and see them through, with deep expertise.
  • Built for your organization — Policies, training, incident response and business continuity plans written for you, not generic templates.
  • Business language — We talk to management in terms of risk and business, not only technology.

The team

Senior security consultants holding CISSP, CISM and CISA certifications, with 25 years of experience guiding organizations.

Start with a conversation.

Send us a few details, and a security consultant will get back to you to see where you stand and what to do first.

Send us your detailsContact us